From 2486869b6ba7c6dbcda01077ad857ec7e00f0070 Mon Sep 17 00:00:00 2001 From: Zakaria Date: Sun, 25 Oct 2026 07:52:52 -0400 Subject: [PATCH] fix(ses): sign in to the SMTP relay with the password, not as an OAuth token Vert.x mail prefers XOAUTH2 whenever the server offers it, so against Gmail the app password was sent as an OAuth token and refused (535 5.7.8). Limit the relay to the password-based SASL methods. --- .../io/github/hectorvent/floci/services/ses/SmtpRelay.java | 5 +++++ .../hectorvent/floci/services/ses/SmtpRelayServerTest.java | 3 ++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/src/main/java/io/github/hectorvent/floci/services/ses/SmtpRelay.java b/src/main/java/io/github/hectorvent/floci/services/ses/SmtpRelay.java index 9826ab1..f943c5e 100644 --- a/src/main/java/io/github/hectorvent/floci/services/ses/SmtpRelay.java +++ b/src/main/java/io/github/hectorvent/floci/services/ses/SmtpRelay.java @@ -57,6 +57,8 @@ public class SmtpRelay { private static final Logger LOG = Logger.getLogger(SmtpRelay.class); private static final long RELAY_TIMEOUT_SECONDS = 30; + /** Every SASL method the mail client supports except XOAUTH2, which expects a token. */ + static final String PASSWORD_AUTH_METHODS = "CRAM-SHA256 CRAM-SHA1 CRAM-MD5 DIGEST-MD5 LOGIN PLAIN"; /** SES control header naming the configuration set to apply to a raw send. */ public static final String HEADER_CONFIGURATION_SET = "X-SES-CONFIGURATION-SET"; @@ -118,6 +120,9 @@ public class SmtpRelay { .filter(u -> !u.isBlank()) .ifPresent(u -> { mailConfig.setUsername(u); + // smtp-pass is a password, never an OAuth token: without this the client prefers + // XOAUTH2 whenever the server offers it (Gmail does) and the login is refused. + mailConfig.setAuthMethods(PASSWORD_AUTH_METHODS); config.services().ses().smtpPass() .filter(p -> !p.isBlank()) .ifPresent(mailConfig::setPassword); diff --git a/src/test/java/io/github/hectorvent/floci/services/ses/SmtpRelayServerTest.java b/src/test/java/io/github/hectorvent/floci/services/ses/SmtpRelayServerTest.java index b64335c..2d2df11 100644 --- a/src/test/java/io/github/hectorvent/floci/services/ses/SmtpRelayServerTest.java +++ b/src/test/java/io/github/hectorvent/floci/services/ses/SmtpRelayServerTest.java @@ -287,7 +287,8 @@ class SmtpRelayServerTest { String command = line.toUpperCase(Locale.ROOT); if (command.startsWith("EHLO")) { reply(out, "250-floci-stub"); - reply(out, "250 AUTH PLAIN"); + // Gmail also offers OAuth sign-in, which a password must never be sent as. + reply(out, "250 AUTH PLAIN XOAUTH2 OAUTHBEARER"); } else if (command.startsWith("HELO")) { reply(out, "250 floci-stub"); } else if (command.startsWith("AUTH")) { -- 2.52.0